IOWA STATE UNIVERSITY READY TO HIT HACKERS HEAD-ON
WITH FIRST-OF-ITS-KIND COMPUTER SECURITY LABORATORY

AMES, Iowa -- When it comes to computer security, Doug Jacobson is tired of
playing nice.

For years, Iowa State University researchers like Jacobson have been
utilizing computer simulations to create defenses against hackers and other
information bandits. But these traditional programs are difficult to
interface with real-world equipment, and they fall short of generating the
perfect environment for obliterating security breaches.

But thanks to a nearly $500,000 grant from the U.S. Department of Justice,
Jacobson and several ISU colleagues are poised to establish the nation's
first-of-its-kind cyber defense laboratory. In short, they're ready to build
their own virtual battlefield.

The Internet-Scale Event and Attack Generation Environment (ISEAGE --
pronounced "Ice Age") is, quite simply, a virtual Internet. Created by
scientists affiliated with the university's Information Assurance Center
(IAC), considered a national leader in computer security education, the
laboratory will allow researchers to test defense systems in an actual
environment where real attacks can be used.

"Since we can't take over the real Internet, we've decided to recreate our
own Internet laboratory," Jacobson, associate professor of electrical and
computer engineering, explained. "We will be able to carry out computer
attacks exactly as they happen in the real world."

The ISEAGE facility will consist of a large room filled with computer
equipment designed to recreate Internet activities. Jacobson, who will serve
as the laboratory's director, anticipates many uses for this facility:

Protection of government and civilian infrastructure. The power
grids for many major systems (e.g. transportation, water systems,
bureaucracy management) are computer-controlled.

"It's important that we understand how these infrastructures work
together, understand their vulnerabilities and learn how to protect against
certain attacks," Jacobson said. "Many infrastructures are highly
interconnected; we'll attack Points A and B and check for the possibility of
system penetrations. ISEAGE won't be burdened by playing nicely on the
Internet."

Evaluation of existing business and industry computer security
systems. Through the use of specialized tools, ISEAGE will be able to mimic
the types of Internet traffic an organization may typically experience, then
superimpose various attacks on the company's established safeguards to
determine their effectiveness.

New security product testing. "We'll be able to recreate exactly
what manufacturers would see if they plugged these devices into the Internet
at their customer facilities," Jacobson said. "Then our laboratory can
launch all kinds of attacks on these products, before they're ever marketed,
to see what they can withstand. While lots of companies have small test
labs, they're only able to look at bits and pieces of their products. Our
full-scale re-creation provides a much bigger attempt for determining
product reliability."

Fighting cyber crime. ISEAGE will help develop new forensics
mechanisms that will trace back systems attacks, Jacobson said, that will
"figure out who did it and what they did." Since budget cuts have eliminated
the Iowa Criminalistic Laboratory's computer forensics expert, the IAC,
along with Iowa State's Department of Public Safety and Midwest Forensics
Resource Center, hope to establish a computer crime investigation effort at
ISEAGE that can serve state law enforcement agencies.

Support academic and research efforts. More than 30 Iowa State
faculty members initially will be conducting research at the lab in the
areas of computer security and security tool development. In addition,
ISEAGE will provide instructional support to the university's current
courses in information assurance and networking, and students will benefit
from access to the facility's equipment to conduct their own research.

The ISEAGE laboratory will be located at the ISU Research Park and open for
business early next year. While the Department of Justice grant will serve
as "seed money," a total of $3 to $5 million is needed for the facility to
be fully operating, Jacobson said.

"This grant money will build a small part of ISEAGE, prove our concept and
then allow us to go out and raise the rest of the money," he explained.
"Hopefully, by early 2005 everything will be in place. But ISEAGE will
continue to evolve and require constant care and feeding.

"This facility will draw good people, good resources and will become a focal
point for security research," Jacobson continued. "ISEAGE will do for this
type of research what the C6 [the world's first fully immersive six-sided
virtual reality theater with wireless tracking and navigation]
has done for human computer interaction
initiatives. It will allow Iowa State to once again stand out."